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SUMMARY 

Analytically redundant sensor failure detection. Isolation, and accommoda- 
tion techniques for gas turbine engines are surveyed. Both the technology base 
and demonstrated concepts are discussed. Results from twenty five papers and 
reports are reviewed which document the development of the field from 1974 to 
the present. Demonstrations of analytically redundant techniques using engine 
simulations or full scale engines are Included. Various differences among the 
three demonstrated approaches are discussed. Finally, ongoing Government pro- 
grams are described. 


INTRODUCTION 

This paper surveys the use of analytical redundancy to Improve turbine 
engine control system reliability. As shown In figure 1 an Increase In control 
complexity has occurred In recent years and Is expected to continue. This 
Increased complexity has made It difficult to build reliable, low cost, low 
weight hydromechanical controls. On the other hand microprocessor based digi- 
tal electronic technology allows complex control systems to be built with low 
cost and weight. However, these digital electronic controls do not have the 
maturity and therefore the demonstrated reliability of hydromechanical engine 
control systems. 

A recent study of fault tolerant electronic engine controls (ref. 1) shows 
that sensor redundancy will be required to achieve adequate control system 
reliability. There are two types of sensor redundancy, hardware and analyti- 
cal. Hardware redundancy (HR) uses multiple sensors to measure the same engine 
variable. Analytical redundancy (AR) uses a reference model of the engine to 
provide redundant estimates of a measured engine variable. HR Is Insensitive 
to failure type, hard or soft, since any discrepancy between two like sensors 
Indicates a failure. (Hard failures are out-of-range or large In-range fail- 
ures. Soft failures are small In-range or drift failures.) AR, however, dis- 
tinguishes failure types. HR results In more costly, heavier, less practical, 
and less reliable systems than do various AR strategies (ref. 1). Consequently 
many researchers have Investigated AR strategies. 

The first objective of this paper Is to survey the application of AR to 
the detection. Isolation, and accommodation (DIA) of sensor failures for gas 
turbine engines. HR strategies are not covered. First, this survey reviews 
the theoretical and application papers which form the technology base of tur- 
bine engine AR research. Second, the status of four major, ongoing, application 
efforts are discussed. An analysis of this survey Indicates some current tech- 
nology needs. The second objective of this paper Is to present NASA's current 
programs which address these technology needs. 



AR Technology Base 


This section describes those papers that document the AR technology base. 
Sixteen papers are considered. The papers are reviewed In essentially chrono- 
logical order. The attributes of each paper are discussed In this section. 
These attributes are summarized In table I. 

Wallhagen and Arpasl (ref. 2) presented the first (April 1974) use of 
sensor AR to Improve engine control system reliability. A J85, single spool,, 
turbojet with two sensed variables and three controlled variables was tested 
at a sea level, static condition. The Inputs were compressor variable geom- 
etry, fuel flow, and exhaust nozzle area. The sensors were a magnetic pickup 
for rotor speed and a high response gage tranducer for compressor static dis- 
charge pressure. Failure detection was accomplished by comparing the rate of 
change of the sensed variables with predetermined limits. Four consecutive 
out of range rates declared a failure. Since each sensor was tested for cata- 
strophic, l.e., hard failure only. Isolation Is Immediate. Failures are accom- 
modated by replacement of the failed sensed value with a synthesized estimate. 
This synthesized variable Is obtained from a tabulation of the synthesized 
variable as a function of remaining engine variables. Different tables were 
stored for steady-state and acceleration conditions. Wo explicit dynamical 
relationships were Included. 

The DIA logic was Implemented In fixed point assembly language on a mini- 
computer. The Implementation executed In a 15 msec time frame which allowed 
real-time Interaction with the control. Testing In a sea level static test 
stand compared Idle to full power step responses of rotor speed and thrust. 

For single failures steady-state speed was held to within 1 percent of Its 
final value and 92 percent of maximum thrust was achieved. For two sensor 
failures steady-state speed was approximately 99 percent of Its final unfalled 
value and thrust was 87 percent of maximum. Time to accelerate, however, had 
to be Increased from 3 to 30 sec. Failures were Induced at 50 percent power 
during a transient. Detection was reliable. The system also allows self- 
healing. An Interesting feature of the DIA logic was Its ability to learn, on 
line, all the data necessary to function. In a companion paper, Hrach, Arpasl, 
and Bruton (ref. 3) used a real-time nonlinear hybrid computer simulation of a 
two spool turbofan, the TF30-P-3 engine to demonstrate the DIA logic of 
reference 1 over a wide operating range. Four sensed variables; high pressure 
rotor speed, high and low pressure compressor discharge static pressures, and 
nozzle total pressure, and five Inputs main fuel flow, nozzle area, afterburner 
fuel flow, and two compressor stage bleeds were considered. Again hard failure 
detection and Isolation were obtained by Individual rate checks. 

Accommodation was achieved by replacement with averaged synthesized vari- 
ables which were a function of the remaining good sensors (1,2, or 3). Synthe- 
sized variables were obtained from tabulations. However, the data were now 
stored as corrected values to allow a wide operating range. Data for the 
tables were collected at two operating points. 

A real-time Implementation of this DIA logic was programmed using assembly 
language In a minicomputer using a frame time of about 25 m/sec. Storage re- 
quirements Include 4K Bytes for the logic and 0.2K Bytes for the tables. The 
logic was tested at 5 selected operating points (which Include the 2 design 
points). Acceptable operation with no limit violations and approximately the 
same thrust was obtained for operation with 1, 2, or 3 of the 4 sensors failed. 
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For afterburning operation of the engine acceptable control was possible for 
only a single failure and with a severe rate limit on accelerations. This 
logic also Incorporated learning or adaptive logic. 

Ellis (ref. 4) (January 1975) studied the use of AR techniques using a 
nonlinear digital simulation of a two spool turbofan engine. The engine had 
five measured variables and two Independent controlled variables. The OIA 
philosophy of this paper centers around estimates of the measured variables. 
First a multivariable linearized mapping (no explicit model dynamics) of cor- 
rected measurements to estimates Is found. Since the engine has only two In- 
dependent controls. It Is assumed that only two measurements are required to 
generate an estimate. Taking unordered pairs of the 5 measured variables 
yields 10 estimates of each measured variable. A weighted average estimate Is 
obtained by combining these ten-component estimates each weighted by Its rela- 
tive accuracy. Detection and Isolation are accomplished by a threshold check 
on both sides of each weighted average estimate. If a weighted estimate Is 
outside of the threshold corridor then all weighting factors associated with 
this estimate are set to zero. Weighted estimates are used by the control at 
all times. Only the weightings change as failures occur. Thresholds for the 
weighted estimates are obtained from sensor error statistics assuming Gaussian 
distributions. 

The next contribution to this area Is documented In four reports by 
deSllva (refs. 5 and 6) and Wells (refs. 7 and 8). This series of reports 
applies Bayesian hypothesis testing to the detection of engine sensor failures. 
The engine studied is a simple turbojet with two outputs, speed and thrust and 
one Input, fuel flow. A second order pseudol Inear (PL) model of the engine 
was used on a mainframe computer to evaluate detection performance. A PL model 
consists of a dynamical, linear state space structure. However, Individual 
coefficients within the linear structure vary as a nonlinear function of the 
state. 

Bayesian hypothesis testing Is Implemented by 1) defining a risk function, 
and 2) determining from measured data the hypothesis that minimizes this risk. 
This risk function defines the penalty associated with selecting a false hy- 
pothesis. Assuming Gaussian noise statistics, the Bayesian hypothesis Is also 
probabilistically most likely given the measured data. A "bank" of Kalman 
filters, one per hypothesis, used measured data and an engine model to generate 
s*tate estimates and filter residuals. The hypothesis associated with the most 
Mkely set of residuals as determined by a likelihood ratio test was taken as 
4e true hypothesis. The mode of operation associated with this hypothesis 
(failed speed sensor, no failure, etc.) was assumed true. The approach worked 
well In simulation studies of this simple case. This work represents the first 
application of AR to turbine engines based upon modern control theory. Diffi- 
culties with this approach Include the requirement of a different Kalman filter 
for each failure mode hypothesis. 

In June 1977 Spang and Corley (ref. 9) published an application of AR 
techniques as applied to the Quiet, Clean, Short Haul, Experiment Engine or 
QCSEE. This engine has seven measurements, fuel flow, compressor stator angle, 
fan speed, compressor speed, compressor discharge temperature and pressure, 
and turbine discharge temperature. Engine controls Include fuel flow valve 
current and compressor stator blade torque motor current. In this study an 
extended Kalman filter approach was used to generate state estimates and resid- 
uals. A simplified nonlinear component model which Is valid throughout the 
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engine operating envelope and a simplified feedback gain matrix operating on 
engine measurements were used to update the filter estimates and residuals. 

Sensor failures were detected and Isolated by a threshold comparison of 
the Individual residual components. Thresholds were determined by sensor noise 
statistics. Only hard failures are considered. To accommodate failures, 
faulty measured values are replaced by sensor estimates from the filter. The 
approach was successfully demonstrated on a detailed, real-time, nonlinear 
hybrid computer simulation of the engine. The detection, accommodation and 
control logic was Implemented In a microprocessor-based control also In real- 
time. Successful operation for single hard sensor failures was demonstrated 
at sea level static conditions for power chops and bursts In the Idle to full 
take-off power range. This work, referred to as Failure Indication and Correc- 
tive Action or FICA, serves as the theoretical foundation for a significant 
portion of the work In the application of AR to turbine engines. Further ap- 
plications based on FICA are given In a subsequent section. 

Next, DeHoff and Hall (ref. 10) reported a largely theoretical study that 
developed a unified framework to achieve engine performance monitoring, trend- 
ing, and sensor fault DIA. This framework Is based upon maximum likelihood 
state and parameter estimation methods. A simple turbojet example was used to 
Illustrate the application of a maximum likelihood based, on line, sequential 
processing, parameter estimation algorithm to the detection of sensor failures. 

Sahgal and Hiller (ref. 11) report on the design of a full order observer 
that reconstructs fan turbine Inlet temperature for an F100 engine. The ob- 
server Is based upon a 5th order scheduled state space model with four Inputs, 
fuel flow, nozzle area and compressor and fan variable geometries and four 
outputs, fan and compressor speed, and compressor discharge temperature and 
pressure. Observer performance Is compared with a full nonlinear digital 
simulation of the engine at sea level static conditions. The reconstructed 
temperature tracks the actual temperature quite well. The analytical study 
proposes to use the reconstructed temperature to accommodate for fan turbine 
Inlet sensor failures. 

The next three papers (refs. 12 to 14) by Lelnlnger and Behbehanl report 
the application of the generalized likelihood ratio (6LR) technique to the 
QCSEE. The 6LR technique Is a hypothesis based test with the time and type of 
failure unknown. Under linear, Gaussian assumptions. If the Kalman-Bucy filter 
residuals are found to be nonwhite, a failure Is declared. Next, various like- 
lihood ratios are compared to determine the most probable failure time and 
type. The GLR method was used to detect and Isolate hard and soft failures. 
Both single and multiple actuator and sensor failures were considered. 

Detection and Isolation studies were conducted by simplified simulation 
of an under the wing QCSEE. This simulation Included six outputs, fan and 
compressor speeds, engine Inlet static pressure, fan Inlet duct static pres- 
sure, combustor pressure and compressor discharge pressure and three Inputs, 
fuel metering valve position, fan nozzle actuator position, and fan pitch 
angle. A linearized, eight state model was used In the Kalman-Bucy filter. 
Successful detection and Isolation of multiple sensor and actuator failures 
with noisy sensors and Imperfect modeling were demonstrated. Accommodation by 
control reconfiguration using nonsquare Multivariable Nyqulst Array methods 
was proposed. Designs were obtained but not demonstrated by simulation. 
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A doctoral dissertation by Meserole (ref. 15) uses detection filter theory 
to design a detection filter that detects sensor failures In an F100 engine. 
Like the Kalman filter, the detection filter Incorporates a dynamic process 
model and generates error residuals. However, unlike the Kalman filter a de- 
tection filter Is designed to respond to a component failure with a residual 
that has a fixed, usually unique direction. Also this direction Is Independent 
of failure mode. Thus, sensor failures can be detected and Isolated by detect- 
ing the occurrence of these fixed direction residuals. A sixth order state- 
space linear model with scheduled coefficients Is used In the detection filter. 
Filter operation and detection capability are demonstrated using a detailed 
nonlinear digital simulation of the F100 engine. Fifteen components are 
checked for failure, the Inlet pressure and temperature sensors, the fan and 
compressor speed sensors, the burner and augmentor total pressure sensors, the 
fan outer diameter discharge and turbine Inlet total temperature sensors, the 
fuel system, the nozzle, bleed, fan guide vane, and compressor stator vane 
actuators, and the high and low pressure turbines. Five Inputs are considered, 
fuel flow, nozzle area, fan guide vane and compressor stator vane positions, 
and bleed. Filter performance was studied for sensor failures and component 
changes (failures) at sea level static conditions for bias and scale factor 
changes. Failures were detected for 2 percent to 5 percent changes In one or 
more output measurements. Minimum failure size for successful Isolation Is 
summarized by component In table II. 

The final paper to be discussed In this section, by Lelnlnger (ref. 16) 
examines the Impact of an Inaccurate model on Innovatlons-based detection and 
Isolation procedures. The paper demonstrates that model Inaccuracies appear 
as biases In the Innovations (residuals). These biases are Identified by a 
"student t” test. The "student t" test Is then related to a recursive GLR 
detector using a sequentially updated Kalman filter. Model bias error Is re- 
moved from the Innovations data to remove the effect of model degradation and 
to allow more accurate soft and hard failure detection. Also, a finite width 
window sequential N t“ test Is used to update the bias term and provide a means 
of sensor failure detection and Isolation. The theory was applied to an 
eighth order linear model of the QCSEE. Model eigenvalues were perturbed by 
10 percent to simulate model error. The "t" test successfully removed the 
bias, tracked a sensor drift followed by a low frequency sinusoidal sensor 
bias, and exhibited a fall-heal-fall detection pattern for the sinusoidal test. 


AR Technology Development 

Based upon the encouraging, but preliminary results of the AR technology 
base, several technology development programs were begun. The overall objec- 
tive of these programs Is the full scale engine demonstration of Improved con- 
trol system reliability using AR technology. Four Important AR development 
programs are discussed 1) Advanced Detection, Isolation, and Accommodation 
(AOIA), 2) Energy Efficient Engine (E 3 ) FICA, 3) Full Authority Digital 
Electronic Control (FADEC) FICA, and 4) Digital Electronic Engine Control 
(DEEC) sensor OIA. 


ADIA 


The objective of the ADIA program Is to demonstrate a viable DIA concept 
based upon advanced methodollgles. The ADIA program consists of three parts: 
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development, real-time evaluation, and demonstration. The NASA Lewis Research 
Center provides overall program sponsorship and technical direction. Pratt 
and Whitney Aircraft, and their subcontractor. Systems Controls Technology, 
developed the ADIA algorithm. A real-time hybrid computer based evaluation 
and a full scale engine demonstration are currently being performed by the 
NASA Lewis Research Center. Each of these program parts Is discussed below. 

The development of the AOIA algorithm Is reported by Beattie, et al. 

(refs. 17 and 18). Here advanced detection and filtering methodologies were 
compared to develop a viable ADIA concept. Comparisons were made on an F100 
engine and F100 Multivariable Control (ref. 19) testbed system. The type and 
severity of sensor failures were carefully defined. Typical state-of-the-art 
transducers were selected. Failure characteristics were defined and quanti- 
fied according to the predominant failure categories of out-of-range, drift, 
and noise. Next, a Failure Mode and Effects Criticality Analysis (FMECA) was 
conducted to classify the various failure modes as critical or noncrltlcal. 
Critical failures result In surge, a 10 percent or larger thrust variation, or 
a rotor overspeed. This classification was accomplished over the full operat- 
ing range of the F100 engine. Five competing DIA concepts were developed by 
combining available detection and filtering technologies. These five concepts 
were specifically formulated to span as many applicable technologies as 
possible. 

Since competing technologies were to be compared, a scoring system was 
developed. The scoring system evaluated the concepts for 1) Performance 
Criteria - transient and steady-state minimum operation requirements, 2) 
Detection Performance - detection and Isolation effectiveness, and 3) Figures 
of Merit - qualitative benefits of bettering the Performance Criteria. Using 
the scoring system and a simplified simulation of the testbed system, the five 
concepts were screened. Two concepts were selected for a more detailed com- 
parison. Based upon this second screening, one concept was selected for evalu- 
ation on a detailed nonlinear simulation of the testbed system. This detailed 
evaluation Included simulated sensor failures for both steady-state and tran- 
sient operation throughout the entire operating range of the engine. This 
evaluation showed the ADIA approach 1) to be viable for gas turbine applica- 
tions and 2) when compared to a parameter synthesis approach, to be more sys- 
tematic and straightforward. This evaluation also pointed out two areas for 
Improvement In the ADIA algorithm. 

First, the accommodation filter was unacceptably biasing normal or un- 
falled steady-state operating point operation. A minor change In the accommo- 
dation logic Improved steady-state operation by removing these unacceptable 
biases. This result Is shown In table III. Here steady-state accuracy for 
the original, or baseline logic Is compared with the revised logic at six 
operating points and various failed parameters. Data were obtained by hard 
falling a sensed parameter and observing the steady-state thrust before and 
after the failure. Estimation errors, for the failed parameter only, are also 
given. Notice that In every case an Improvement In steady-state accuracy was 
obtained as measured by a smaller change In engine thrust. 

Second, the simplified model used In the algorithms filter was not accu- 
rate enough at all flight conditions. To Improve simplified model accuracy, 
additional linear, state-space model data were Incorporated In a redesign of 
the simplified simulation. In total, linear state-space models at 76 different 
operating points that more uniformly span the entire flight envelope were used. 
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Individual elements of the state-space matrices were corrected to reduce data 
scatter and then scheduled by a nonlinear polynomial of selected model output 
variables over the flight envelope. This scheduled state-space system forms 
the basis of the simplified simulation. A more complete description of this 
modeling technology as applied to the development of a hypothetical turbofan 
engine simplified simulation (HYTESS) Is given by Merrill, et al. (ref. 20). 
figure 2 shows a transient response comparison for the nonlinear digital engine 
simulation and the AOIA simplified simulation for an Idle power to Intermediate 
power (PLA = 20° to 83°) step command. This comparison demonstrates the ex- 
cellent estimation capability of the simplified simulation. The AOIA algorithm 
Incorporates this simulation and Kalman filter logic to further Improve these 
estimates. 

The testbed system with AOIA and MVC logic Is shown In figure 3. The 
algorithm consists of an extended steady-state Kalman filter, called the accom- 
modation filter, that generates sensor estimates and residuals based upon a 
simplified, pseudo-linear model of the engine. These residuals are compared 
to thresholds for hard failure detection and Isolation. A weighted sum of the 
squared residuals (WSSR) statistic Is computed and compared to a threshold to 
detect soft failures. When a soft failure Is detected. Isolation Is accom- 
plished using a bank of five Kalman filters (one for each sensor) and likeli- 
hood ratio test of the five different filter residuals. After a failure Is 
detected and Isolated, the faulty Information Is removed from the accommodation 
filter by reconfiguration. Estimates of all sensor outputs are still produced 
but now they depend upon the set of unfalled measurements. The AOIA algorithm 
Interfaces with the MVC algorithm In two ways. First, It supplies the linear- 
quadratic regulator (LQR) with estimates of the engine outputs at all times. 
Second, It supplies the Integral control logic with actual sensed values In 
the normal mode. An Individual sensed value Is only replaced with an estimate 
when a failure occurs and Is detected and Isolated. 

Detailed evaluation results demonstrated the ability of the AOIA algorithm 
to completely cover hard sensor failures and most soft sensor failures. The 
hard failure results were excellent. All failures were covered with nearly 
Instantaneous detection and Isolation throughout the flight envelope. Accom- 
modation transients were well within allowable ranges. Steady-state perform- 
ance was good (see table III). On the other hand, soft failure DIA, especially 
for a full envelope design, represents a substantially more difficult task 
than hard failure OIA. In spite of this challenge, soft failure DIA perform- 
ance was generally good. However, some soft failure modes remained uncovered. 

Table IV Is a summary of the evaluation of the soft failure DIA capability 
of the ADIA algorithm. Here data were obtained by Injecting slow drift fail- 
ures In various parameters at a variety of operating points throughout the 
envelope. Sixteen failure scenarios are presented. The estimation error or 
bias before failure Isolation as well as the thrust change, and time to Isola- 
tion are given for each scenario. Nine of the presented scenarios represent 
acceptable soft failure OIA performance. These scenarios Include PT4, PT6, and 
FTIT coverage over a large portion of the flight envelope with small thrust 
deviations. One speed failure (N2) was also covered. Seven of the presented 
scenarios represent unacceptable performance. Five of these are rotor speed 
(N1 or N2) failures. Because the filter estimation process Is strongly depen- 
dent on N1 and N2 measurements (particularly N2) a slow bias error In the speed 
signals will be tracked closely. Therefore the residuals will remain small 
and will not Indicate a soft failure. As the filter Is made less dependent on 
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rotor speeds, estimation accuracy decreases. This tradeoff requires more study 
and will be one of the subjects Investigated In the real time hybrid evaluation 
phase. 

The second part of the ADIA program Is the real-time evaluation of the 
algorithm on a hybrid computer F100 engine simulation. A real-time micro- 
processor based Implementation of the MVC and ADIA algorithms Is required to 
complete this evaluation. DeLaat and Merrill (ref. 20) describe this Implemen- 
tation. Two 5 MHz Intel 8086 based microprocessors operating In a parallel 
processing environment are used to meet the update time requirement. The first 
computer contains a fixed point, assembly language, real-time Implementation 
of the MVC which had been Implemented and evaluated previously (ref. 22). The 
second computer contains the ADIA logic Implemented In floating point FORTRAN. 
Floating point arithmetic was used since the Intel 8087 floating point copro- 
cessor was available. FORTRAN was used because of the flexibility of program- 
ming In FORTRAN versus assembly language. Also, a good FORTRAN compiler for 
the 8086/8087 was available. This control hardware Is currently being used 
with a hybrid computer engine simulation to evaluate the ADIA algorithm's real- 
time performance. 

The third part of this program Is the full scale engine demonstration of 
the ADIA algorithm. Current planning projects this evaluation to occur In the 
first quarter of 1985. The demonstration will take place In the NASA Lewis 
Research Center altitude test facility. The microprocessor hardware and soft- 
ware developed and evaluated In phase two of this program will be used In this 
demonstration. 


E 3 FICA 

The E 3 program Is developing technology for Improving the energy effi- 
ciency of future commercial transport aircraft engines. A FADEC based upon 
the bit-slice AMD 2901 microprocessor Is used to Implement the control and 
FICA logic for the engine developed under this program (ref. 23). The FICA 
logic Is based upon the concept of Spang and Corley (ref. 9). Here, a sixth 
order extended Kalman filter Is used to generate seven sensor estimates, fan 
and core speed, compressor Inlet and discharge temperatures, turbine discharge 
temperature, fuel metering valve position, and compressor discharge static 
pressure. The Kalman filter uses a dynamic model of simplified engine aero- 
thermodynamics and rotor dynamics. Actuator and sensor dynamic models are 
also Included. This model accurately describes the engine over the full power 
range and flight envelope using simplified component modeling. The Kalman 
gain matrix Is computed at a key operating point using a linearized engine 
model. Sensor failures are detected when the sensed versus estimated differ- 
ence Is greater than a prespecified tolerance. Out of range failures are also 
detected. The tolerance Is estimated by statistical analysis and adjusted 
during simulation trials. Accommodation of failures Is accomplished by re- 
placement of sensed with estimated values. A nonlinear real-time simulation 
evaluation of the FICA logic showed that the filter estimate tracked the sensed 
values within the specified tolerance and successfully detected. Isolated, and 
accommodated all hard sensor failures except fuel metering valve position. 
Multiple failures were also successfully handled. Tests with a reduced order 
Implementation of the Kalman gain matrix that eliminated the three temperature 
sensors showed successful DIA with all sensors except core speed and fuel 
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metering position. The E 3 FICA logic does not detect slow drift, l.e., soft, 
sensor failures. 


FAOEC FICA 

Under the FAOEC program (ref. 24), AR techniques (In particular FICA) 
were applied to two engines, a Joint Technology Demonstrator Engine (JTDE) and 
to the F404 afterburning turbofan engine. Each of these applications Is dis- 
cussed below. 

The JTDE FICA was designed for a variable cycle engine with seven manipu- 
lated variables and nine sensed variables. The engine model used In the JTDE 
FICA Is a second order, dynamic pseudo linear model valid throughout the flight 
envelope. The model Is updated by an observer. Observer gains were chosen as 
the reciprocals of corresponding engine model steady-state gains at a high 
power condition. Gains were then adjusted to achieve adequate stability mar- 
gins. For failure detection sensor model errors were compared to a preset 
threshold. Substitution of estimated variables was demonstrated using a simu- 
lation and subsequently a full scale engine. The engine demonstration was 
limited to sea level static conditions and single substitutions. Single sub- 
stitutions for fan speed, compressor discharge static pressure, and compressor 
Inlet temperature were successfully performed. Also demonstrated by simulation 
In this program was the application of FICA techniques to actuator sensor fail- 
ures. In particular, fuel flow and nozzle area actuator hard out-of-range 
sensor failures were detected and accommodated. 

The second application Is the F404 FICA. The F404 Is an afterburning 
turbofan engine with a rear variable area bypass Injector (VABI) to permit 
selective cycle rematch. The VABI adjusts the bypass to core air ratio to 
match cycle demands. The engine Includes five Inputs and five outputs. A 
simplified, fourth order, component level model (ref. 25) Is used In the FICA 
system. The model Is accurate throughout the flight envelope and was Imple- 
mented In FAOEC microprocessor hardware In a 0.01 second update time Increment. 
The model along with the FICA update logic was checked against actual engine 
operation during full scale engine tests at sea level static and altitude con- 
ditions from September 1981 to April 1982. Steady-state and transient model 
accuracies were judged to be excellent. Single, double, and triple substitu- 
tions of FICA generated estimates were successfully performed during the engine 
tests. These combinations are summarized In figure 4. Actuator FICA was also 
successfully demonstrated for exhaust nozzle hard open and closed failures. 
Thrust level In these cases was maintained by adjusting the gas generator speed 
reference schedule. 


DEEC DIA 

The DEEC system Is a digital full-authority control system containing 
selectively redundant components and fault-detection logic. The system also 
contains a hydromechanical back-up control. Most of the sensors In the control 
are hardware redundant. However, failures of the Inlet static pressure PS2, 
burner pressure, PB, and fan turbine Inlet pressure, FTIT, are covered using a 
form of AR called parameter synthesis (PS). 
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InlPS an estimate of one measured variable Is synthesized from an alge- 
braic function of one or more different measured variables. This relationship 
Is static, l.e., no explicit dynamics are Included. If PS2 falls a range 
check, a synthesized PS2 Is determined from PB, compressor speed, N2, and Inlet 
total temperature, TT2. IF PB falls, a synthesized PB Is calculated from Inlet 
total pressure, PT2, N2, and TT2. Fault detection of PB failures Is based 
upon a comparison of measured and synthesized values. A comparison tolerance 
of ♦ 25 percent determines failures. This large tolerance precludes detection 
of soft failures. Both PS2 and PB failures are accommodated by substitution. 

There are two groups of FTIT sensors. This allows hardware redundancy. 
However, If both FTIT sensor groups fall a range check, synthesized FTIT Is 
substituted Into the control. Synthesized FTIT Is a function of PB and PT2. 

The OEEC DIA logic was verified by closed-loop bench testing. Simulated 
sea level and altitude engine transients were performed. Faults were Inten- 
tionally produced to evaluate OIA effectiveness. Subsequent sea level and 
altitude full scale engine tests uncovered no new problems with the DIA logic. 

A series of flight tests of an FI 5 aircraft with an F100 engine and DEEC con- 
trol further demonstrated the DEEC Logic (ref. 26). During the flight pro- 
gram, the DEEC DIA logic did not detect any false alarms and did not cause any 
reversions to backup hydromechanical control. Two sensor failures occurred 
during the flight program. One, Inlet temperature, was covered by redundant 
hardware. The second, exhaust nozzle pressure, failed to a high scale sensor 
limit. Appropriate accommodation action was taken by the logic In each case. 

Neither of the two sensor failures encountered In the flight test program 
demonstrated the AR based logic of the OEEC DIA. Additional flight tests are 
planned for late 1984 which will Incorporate Intentional sensor faults to com- 
pletely evaluate the DIA logic. 


AR Technology Assessment 

From the above survey an assessment of the relative state-of-the-art of 
applied AR can be obtained. The results presented In the technology baseband 
summarized In table I, demonstrate the feasibility of AR based DIA. In par- 
ticular straightforward range or rate checks have provided successful detection 
of hard sensor failures. Further, advanced DIA approaches based upon advanced 
statistical decision theory and optimal filtering have demonstrated soft fail- 
ure DIA feasibility. However, this soft failure DIA capability Is obtained at 
the cost of Increased computational complexity. This additional complexity 
consists of two parts: the filtering and decision making logic, and a more 
accurate, and therefore more detailed, model. These results also demonstrate 
a tradeoff between ability to accurately detect and time to detect. Where 
hard failures can be detected almost Instantly, soft failures are reliably 
detected only after some finite amount of time. This time to detect Is a 
function of threshold level, which determines detection reliability, model 
accuracy, and logic complexity. 

Further results presented In the technology development section demon- 
strate AR based DIA capability for hard sensor failures on full scale engines 
over a limited range of power and flight conditions. Soft failure DIA has 
been demonstrated throughout the flight and power envelope but only on a de- 
tailed nonlinear simulation of the engine. Full scale engine testing remains 
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to be done. A study of the results of this development clearly emphasizes 
the fundamental Importance that modeling plays In successful OIA. A model 
detailed enough for accurate DIA throughout the flight envelope Is a signifi- 
cant technical challenge. Expectedly, when faced with a difficult technical 
problem, different approaches are pursued. Three different modeling approaches 
have been used: 1) Parameter Synthesis (PS), 2) Pseudol Inear (PL), and 3) Sim- 
plified Component (SC). Both PS and SC approach have been used In successful 
hard failure DIA on full scale engines. The PL method has been demonstrated 
for both hard and soft failure DIA using a detailed nonlinear simulation. 

Each approach has Its advantages and disadvantages. 

The PS approach which was used In the DEEC DIA Is simple to understand 
and straightforward to Implement. Explicit dynamics are normally not Included. 
However, this simplicity Implies a less accurate model. Also, the most accu- 
rate Interrelationships between measured and synthesized variables can not be 
easily or systematically Identified. Model modifications are easily made. 

The SC approach, which was used In the FADEC FICA, results In more accu- 
rate models than the PS approach. SC models are based upon detailed nonlinear 
engine simulations. Detail Is selectively removed from the detailed simulation 
to maximize simplicity while maintaining accuracy. This process requires a 
great deal of judgment and Is not straightforward or systematic. Additionally, 
simplified model performance Is not easily predicted. An SC model relates 
naturally to the physics of the actual engine and Is therefore readily under- 
standable. However, modification of an SC model Is not straight forward since 
changes In component performance can unpredlctably effect model performance. 

The PL modeling approach which Is used In the ADIA algorithm. Is a very 
organized, systematic approach. However, to achieve accuracy through a wide 
range of conditions requires a large amount of stored data. The relationship 
of a PL model with engine physics Is not as straightforward as for an SC model. 
However, steady-state and dynamic model performance can be separated and modi- 
fied Independently. Due to the linear structure of the model equations, anal- 
ysis and performance prediction Is much easier with a PL model than with PS or 
SC models. Additionally, the complexity-accuracy tradeoff Is more clearly 
defined for a PL model. 


Current Programs 

Currently four programs are underway to address technological needs In AR 
based DIA. These programs are AOIA, Robust DIA (RDIA), Multiple Engine DIA 
(MEDIA), and Analytical Redundancy for Engine Reliability Improvement (ARTERI). 


ADIA 

As stated In the technology assessment, soft failure DIA has not been 
demonstrated on a full scale engine. This Is one of the main objectives of the 
ADIA program. As such. It represents the first serious attempt at soft failure 
DIA. Also, this program represents the first full envelope design. Including 
design, development, evaluation, and full scale engine demonstration. To 
accomplish this program, a real-time microprocessor based Implementation of 
the ADIA has been Implemented and Is being evaluated on a real-time hybrid 
engine simulation. This evaluation will establish an Important data point on 
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the tradeoff between detection time and reliability, as well as algorithm com- 
plexity and detection capability. A successful full scale engine demonstra- 
tion of hard and soft failure OIA will clearly establish AR based DIA as an 
accepted tool to Improve engine control system reliability. 


ROIA 


NASA Is currently pursuing basic research In Robust Detection, Isolation, 
and Accommodation (RDIA) of sensor failures. This research focuses on one 
fundamental question. How accurately must engine dynamics be modeled for suc- 
cessful DIA. A definitive answer to this question would establish the quanti- 
tative tradeoffs between complexity, detection time and detection performance. 
An alternative viewpoint would be to define the robustness of a DIA algorithm 
to model Inaccuracies or uncertainty. Two contractors, Alphatech, Inc. and 
Systems Control, Inc. have Identified two different approaches to the solution 
of this problem. 

Alphatech, Inc. bases their research on redundancy, or parity relations. 
These relationships among the measured system variables Incorporate all pos- 
sible redundant Information available. Modeling uncertainty affects the re- 
liability of these parity relations. For a quantified level of uncertainty, 
all parity relations can be ranked from most to least reliable. This allows 
the more reliable parity relations to be used to generate DIA strategies that 
are as robust to uncertainty as possible. 

Systems Control Technology (SCT) bases their research on recent advances 
In robust control system design. Model uncertainty effects on DIA robustness 
will be quantified using conic sector uncertainty properties. Here uncertainty 
that Is bounded In a conic sector In the frequency domain and which then propa- 
gates through a system, remains bounded by a conic sector. These sectors 
determine quantitatively the performance/robustness tradeoff. This frequency 
domain description of uncertainty along with frequency shaped linear quadratic 
filter design theory allow the DIA strategy to be designed In the frequency 
domain. This frequency shaped filter will yield Innovations that are optimally 
robust to model uncertainty. Thus, sensor failure detection based upon these 
Innovations will also be robust. 


MEDIA 


A current NASA program Is Investigating a variation of hardware redundancy 
to Improve soft failure DIA capability. In this contracted feasibility study. 
General Electric Corp. examined a multlenglne approach (In this case two 
engines) to soft failure DIA. The underlying principle Is to use a like sensor 
measurement from one engine as redundant Information to Improve DIA capability 
on another engine. This approach Incorporates a model of potential engine 
differences, an average engine model, and decision logic. By looking at the 
sum and differences of redundant sensed values for the two engines, measured 
average and differential performance Is obtained. These are compared to the 
average and difference engine models contained In the DIA logic. This addi- 
tional Information allows Improved DIA performance over a single engine con- 
cept. This concept was demonstrated using a digital nonlinear engine 
simulation. 


12 



ARTERI 


The final program, ARTERI Is sponsored by the US Navy. ARTERI started In 
October 1983 and Is a three year program. Its objectives are to develop AR 
techniques based upon FICA to the point where they may be employed In a full 
scale engine development program. Both hard and soft failures must be covered 
over the full range of engine power and flight conditions. A detection filter 
approach Is proposed to extend FICA to Include a soft failure DIA capability. 
Also, to be Included Is a thorough Investigation of the ability of the logic 
to discriminate among sensor, actuator, and engine failures. The results will 
be evaluated on a full range nonlinear transient simulation. This simulation 
will Include models for the extended FICA and FADEC control logic. The results 
will then be demonstrated on a full scale Joint Technology Demonstrator Engine 
In 1986. 


CONCLUDING REMARKS 

The technology base for AR based sensor failure DIA strategies for gas 
turbine engines has been surveyed. Several observations and conclusions are 
made. First the technology base often builds or expands upon technology 
developed for aircraft controls. This Is particularly true of hypothesis based 
techniques. However, less stringent reliability requirements and more adverse 
sensor environments are pushing the engine controls designer to AR rather than 
HR solutions to reliability requirements. Secondly, modeling Is the key Issue 
In the success or failure of AR techniques. Three types of models are used. 
Each has Its advantages and disadvantages and no clear preferred type emerges. 
Finally, simulation or full scale engine testing has conclusively shown the 
feasibility of AR based DIA for hard failures. Soft failure DIA has been 
demonstrated, so far, only by simulation. The results were very encouraging 
but not totally successful. Work remains to be done In this area. 

Three on-going Government sponsored programs that address soft failure 
DIA were summarized. One of these programs will supply a complete theoretical 
understanding of robust DIA concepts. The second showed the feasibility of 
multlenglne DIA concepts. The third will extend FICA technology to full scale 
engine development. Finally, the ADIA program will be taken to a full scale 
engine test to demonstrate a soft failure DIA capability. 
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TABLE II. - MINIMUM FAILURE SIZE FOR A DETECTION 
FILTER DESIGNED FOR AN FlOO ENGINE 


Detection: 2 percent to 5 percent change 

in one or more output measurements. 


Isolation 



Minimum failure size. 


percent 


Engine 

state 


Steady 

Unsteady 

Output sensors 

2 

5 to 10 

Inlet sensors 

2 

5 to 10 

Fuel system, exhaust nozzle 

5 to 10 

10 to 20 

Compressor vanes, fan vanes 

10 to 30 

20 to 60 

Rotor efficiencies 

2 

5 to 10 


TABLE III. - STEADY STATE COMPARISONS 


FI ight 
operating 
point 

Failed 

parameter 

Baseline DIA 
algorithm 

Revised DIA 
algorithm 




Thrust 

change, 

percent 

r j 

Thrust 

change, 

percent 

0/0/24° 


+100 

+5.3 

+55 

+2.1 

0/0/83° 


-5.5 

-3.1 

-4.2 

~ 0 

10k/0. 75/83° 


+15 

-2.2 

+60 

~ 0 

20k/0.3/40° 

wmM 

-0.49 

-4.9 

-0.33 

+1 

20k/0.3/83° 


-70 

-5.5 

-70 

+0.15 

60k/l .2/83° 

IB 

-0.18 

+7.1 

-0.36 















Li- S_ 

• o 

CC CD 
O r— 















16 



Figure 1. - Trends in control complexity of aircraft turbine 
engines. 



Figure 2. - Transient response comparison of 
nonlinear digital simulation (engine) and the 
ADIA simplified simulation (estimate). Flight 
conditions: altitude, Oft; Mach number, 0; 
power lever angle, 20° to 83° at 0. 2 sec. 
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Figure 2 . - Concluded. 



F100 ENGINE 



Figure 3. - FlOO testbed system with ADIA algorithm and MVC control. 
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Figure 4 - F404 FICA sensor substitution results. 











1. Report No -N/\SA TM-83695 2. Government Accession No. 

‘ AIAA-84-1452 

3. Recipient's Catalog No. 

4. Title and Subtitle 

Sensor Failure Detection for Jet Engines Using 
Analytical Redundancy 

5. Report Date 

6. Performing Organization Code 

505-32-6B 

7. Authors) 

Walter C. Merrill 

a Performing Organization Report No. 

E-2123 

10. Work Unit No. 

9. Performing Organization Name and Address 

National Aeronautics and Space Administration 
Lewis Research Center 
Cleveland, Ohio 44135 

11. Contract or Grant No. 

13. Type of Report and Period Covered 

Technical Memorandum 

12. Sponsoring Agency Name and Address 

National Aeronautics and Space Administration 
Washington, D.C. 20546 

14. Sponsoring Agency Code 

IS. Supplementary Notes 


Prepared for the Twentieth Joint Propulsion Conference cosponsored by the AIAA, 
SAE, and ASME, Cincinnati, Ohio, June 11-13, 1984. 


16. Abstract 


Analytically redundant sensor failure detection, isolation and accommodation 
techniques for gas turbine engines are surveyed. Both the theoretical technology 
base and demonstrated concepts are discussed. Also Included is a discussion of 
current technology needs and ongoing Government sponsored programs to meet those 
needs. 


17. Key Words (Suggested by Authors)) 18. Distribution Statement 

Gas turbines; Sensor failures; Detection; Unclassified - unlimited 


Isolation; Accommodation; Analytical STAR Category 07 

redundancy; Survey 


19. Security Ciassif. (of this report) 

20. Security Ciassif. (of this page) 

21. No. of pages 

Unclassified 

Unclassified 



22. Price* 


*For sale by the National Technical Information Service, Springfield, Virginia 22161 























National Aeronautics and 
Space Administration 


SPECIAL FOURTH CLASS MAIL 
BOOK 


Washington, D.C. 
20546 



Official Business 

Penalty for Private Use, 1300 


Postage and Fees Paid 
National Aeronautics and 
Space Administration 
NASA-451 




POSTMASTER : 


If Undeliverahle (Section 1 5K 
Postal Manual) Do Not Return 




